KRACK (Key Reinstallation Attack) is an internet security vulnerability that was discovered by Mathy Vanhoef, computer security researcher and doctor of Engineering Science at the University of Leuven in Belgium. Vanhoef also wrote a research paper and created a website with detailed information on the subject.
How it works
KRACK targets the WPA2 protocol, specifically the encryption keys used by the protocol to encrypt data traffic within the network. These encryption keys are to be installed and used just once by the protocol as a security measure, but Vanhoef indicated in his research that WPA2 does not guarantee this.
A protected Wi-Fi network initiates the four-way handshake when a client (device) attempts to connect to it. An encryption key is installed once the network receives message three of the four-way handshake. However, in certain instances, the client may not receive message 3 and be able to provide the appropriate response to the network. The network then re-sends message three, causing the client to receive it multiple times, and the same encryption key to reinstalled and reused over and over.
A hacker who is within range to access your Wi-Fi can abuse this by forcing resets through exploiting the KRACK vulnerability, which basically collects and re-transmits message three of the four-way handshake. Upon doing so, the hacker can intercept, decrypt, and manipulate your data packets.
Why you should be worried
According to Vanhoef, Linux and Android (Android 6.0 and higher) devices are more at risk due to them using versions of a Wi-Fi client called wpa_supplicant, which makes it easier for hackers to decrypt data packets.
To prove it, the Belgian researcher launched a KRACK demonstration on an Android smartphone and recorded it on video. In the video, Vanhoef was able to recover the login credentials of a dummy match.com account.
The information that can be decrypted, though, isn’t just login credentials. KRACK can be used to steal private and sensitive data such as banking details (account numbers, passwords, transactions), emails, and all other kinds of confidential information. By using a KRACK, hackers can also infect your system with malware.
He says that at this time, around 50% of Android devices in the world are vulnerable to KRACK. However, Vanhoef does state that all devices (Windows, iOS, etc.) can be exploited, not just ones that use Android or Linux. This is because the vulnerability is found in the WPA2 security protocol embedded in all networks that use protected Wi-Fi. The said vulnerability is in the wireless standard itself, so it’s not limited to certain products or operating systems. This means that no Wi-Fi network can be considered secure anymore, whether it be your home network, office network, or the public Wi-Fi in a library or coffee shop.
How you can protect yourself
Vanhoef has made scripts that detect whether a network is vulnerable to KRACK. He says he’ll release the scripts to the public, but he needs time to fully optimize them.
In the meantime, to thwart attacks, Vanhoef’s suggestion is to update your devices as well as the firmware of your router. He also implores users to communicate with their vendors in order to address the issue. So, contact your vendors as soon as possible and obtain details as to how you can defend yourself against KRACK. He says it’s also important to change your router’s password on the router’s admin page if you haven’t changed it from the generic one provided by the vendor.
Use Hotspot Shield
The best way you can uphold your internet security against KRACK is by using a trusted Virtual Private Network (VPN) like Hotspot Shield. With Hotspot Shield, your internet traffic is encrypted, thereby protecting all your data.
Our VPN uses high-quality security measures such as TLS 1.2 with perfect forward secrecy, 128-bit AES data encryption, and HMAC message authentication to ensure that cybercriminals won’t be able to access and steal your information.
It’s also ideal to not use public Wi-Fi, but if it simply can’t be avoided, it’s essential that you turn on a VPN like Hotspot Shield to protect yourself and your information from hackers and spies lurking in the network.
What are you waiting for? Fortify your connection, secure your information, and prevent KRACK by getting Hotspot Shield today. It’s available for Windows, Mac OS, Android, and iOS.